# BAD\_GRANT\_TYPE Error - Authentication for Webhooks v4 **URL:** \ **Category:** APIs & Integrations\ **Tags:** oauth\ **Created:** [November 6, 2025, 8:01am UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154 "2025-11-06T08:01:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![miguelncg](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@miguelncg](https://community.hubspot.com/u/miguelncg)\ **Post date:** [November 6, 2025, 8:01am UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154/1 "2025-11-06T08:01:00Z")
Hello everyone, I’m trying to get an access token using the `client_credentials` grant type so I can manage Webhooks V4. I’m using the Client ID and Client Secret from my app, but I keep receiving a `BAD_GRANT_TYPE` error. {“status”:“BAD\_GRANT\_TYPE”,“message”:“missing or unknown grant type”,“correlationId”:“3c50489d-180c-4a7a-bc66-6cdd1a06c277”} ```lia-code-sample curl --location 'https://api.hubapi.com/oauth/v1/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'client_id=my_client_id' \ --data-urlencode 'client_secret=my_client_secret' \ --data-urlencode 'scope=developer.webhooks_journal.read developer.webhooks_journal.subscriptions.read developer.webhooks_journal.subscriptions.write developer.webhooks_journal.snapshots.read developer.webhooks_journal.snapshots.write' ``` Am I missing a step, or perhaps using the wrong credentials for this grant type? My understanding was that `client_credentials` is the correct flow for server-to-server API access for these developer scopes. Any help would be greatly appreciated! ---
**Author:** ![chighsmith](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chighsmith](https://community.hubspot.com/u/chighsmith)\ **Post date:** [November 10, 2025, 2:38pm UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154/2 "2025-11-10T14:38:26Z")
Hi @miguelncg, Thank you for posting to the Community! I’d like to tag in some of our Top Contributors to see if they have any ideas on this one -- Hi [@HubSpot\_Corey](https://community.hubspot.com/t5/user/viewprofilepage/user-id/580930) @louischausse and @Teun Do any of you have any suggestions for @miguelncg? Thank you! Cassie, Community Manager ---
**Author:** ![GRajput](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/grajput/32/102020_2.png) [@GRajput](https://community.hubspot.com/u/GRajput)\ **Post date:** [November 11, 2025, 7:44am UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154/3 "2025-11-11T07:44:15Z")
Hi @miguelncg Hey, I think you are trying to hit an API endpoint. If so, then the approach you should use is to create a private app in instance, provide all the required scopes as per the need, and then use its access token to hit the API. There is no need to create the public app. I hope this will help you out. Please mark it as **Solution Accepted and upvote** to help another Community member. Thanks! ---
**Author:** ![miguelncg](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@miguelncg](https://community.hubspot.com/u/miguelncg)\ **Post date:** [November 11, 2025, 8:11am UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154/4 "2025-11-11T08:11:44Z")
Hey Gaurav! Thank you for taking the time to reply. Unfortunately, I don’t believe the private app approach will work for this use case. The scopes I am trying to access (like `developer.webhooks_journal.read` and `developer.webhooks_journal.subscriptions.write`) are for the Webhooks V4 API. According to HubSpot’s documentation, these scopes are only available for public apps and cannot be added to private apps. Thanks, Miguel ---
**Author:** ![RubenBurdin](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rubenburdin/32/75212_2.png) [@RubenBurdin](https://community.hubspot.com/u/RubenBurdin)\ **Post date:** [November 28, 2025, 7:56pm UTC](https://community.hubspot.com/t/bad-grant-type-error-authentication-for-webhooks-v4/142154/5 "2025-11-28T19:56:15Z")
Hi @miguelncg , good question, this part of the docs is easy to misread. HubSpot’s public app OAuth flow today only supports authorization\_code (and then refresh\_token) for getting access tokens. The /oauth/v1/token endpoint simply does not accept client\_credentials as a valid grant\_type, which is why you’re getting BAD\_GRANT\_TYPE even though the payload looks correct. In other words, for those developer.webhooks\_journal.\* scopes, you still have to go through a standard OAuth install on a developer test account or portal, get an auth code, exchange it for an access token, and then keep it fresh with the refresh token flow ([Working with OAuth | OAuth Quickstart Guide - HubSpot docs](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/oauth-quickstart-guide) ) Private apps won’t help here, as you already spotted, because those specific scopes are only available to public apps. The clean pattern is usually: public app with the Webhooks v4 developer scopes, one install into a “control” portal, store the refresh token securely, and build a small server-side job that rotates access tokens using grant\_type=refresh\_token only. That keeps it server-to-server in practice, even if the underlying OAuth flow is not pure client\_credentials on the wire. If you later need to mirror those webhook events into another system reliably, Stacksync can consume HubSpot changes and keep your downstream database or CRM in step without you having to juggle custom token logic and sync code.\_